ORDERING AND LICENSING GUIDE FOR MAG SERIES JUNOS PULSE GATEWAYS

Transcription

1 SALES GUIDE ORDERING AND LICENSING GUIDE FOR MAG SERIES JUNOS PULSE GATEWAYS There are several components to every Juniper Networks MAG Series Junos Pulse Gateways purchase. This guide explains every component and how to order each MAG Series gateway, complete with all necessary licenses and some services options. Section I explains the different types of licenses available on the MAG Series platform. Section II describes the availability of each type of license for each platform, explains any special information relevant to software or hardware ordering for that particular platform, and includes a complete listing of SKUs by product. Section III provides several example configurations of the MAG Series models. SALES TIP: Ensure that common access licenses are evenly distributed prior to enabling clustering. Each service module in a MAG6610 or MAG6611 chassis must have licenses installed (no leasing of licenses within the chassis is allowed without adding the enterprise licensing option). Service modules also need to follow the new cluster licensing feature requirements, as first implemented in SA Series version 7.0 software. Section I: License Types and Explanations Common Access License (Concurrent User License, Required) With the MAG Series Junos Pulse Gateways, common access licenses are available as user licenses. With common access licensing, the licenses can either be used for SSL VPN user sessions or network access control (NAC) user sessions. The common access user licenses allow remote users to actually gain access to the network. These licenses are for user access on all models. They enable customers to support as many users as specified in the license, and user licenses are additive. For example, if you sell a 100 user license and then sell another 100 user license for the same machine, that customer would have 200 concurrent users available for use on that machine. High Availability Clustering Capability (No Additional License Required) Customers have the ability to build clusters without buying any additional licenses. The clustering method can be explained in two simple steps: 1) Simply place an equal number of user ( -ADD ) licenses on each box. 2) When they are joined together to form a cluster, all of the user licenses add up so that the cluster can now support all of the licensed users. For example, building a 1,000-user cluster is done by bringing together two boxes with 500 user licenses in each of the two units. Clustering features stateful peering and failover across the LAN so in the unlikely event that one unit fails, system configurations (such as authentication server, authorization groups, and bookmarks), user profile settings (such as user defined bookmarks and cookies), and user sessions are preserved. Failover is seamless, so there is no interruption to user/enterprise productivity, no need for users to log in again, and no downtime. Here are the clustering options for the MAG Series. 1) MAG2600 can be clustered in a pair. 2) MAG4610 can be clustered in a pair. 3) For MAG6610, you can cluster two service modules in a pair (assuming any two service modules are installed in the chassis, either the MAG-SM160 or MAG-SM360). 4) For MAG6611, you can cluster two service modules in a pair, either using the MAG-SM160 or MAG-SM360. To cluster three or four service modules will require the MAG-SM360 service modules in the chassis. Please note that WAN clustering is not supported on the MAG Series. Multisite clustering is supported, however, provided the sites are on a campus network with LAN-like connectivity. 1

2 Feature Licenses (Optional) Feature licenses enable functionality not available with the standard common access licenses alone. Secure Meeting (Note that this is different than previous Secure Meeting licensing models.) The Secure Meeting license enables Secure Meeting functionality for online collaboration on a single MAG Series gateway or cluster, allowing your customers to conduct secure online meetings using their MAG Series gateway. For the MAG Series, Secure Meeting is licensed through a concurrent user model. Secure Meeting supports four license options on the MAG Series, and up to 25, 50, 100, or 250 concurrent meeting users options are offered. Please note that the meeting user count is separate from the concurrent SSL VPN users count on the MAG Series. Also, there is a limit to the maximum number of licenses that can be supported on certain MAG Series models. A single MAG2600 will support up to 50 concurrent meeting users. A single MAG4610 will support up to 100 concurrent meeting users. The MAG-SM160 service module (for MAG6610 or MAG6611 chassis) will support up to 100 concurrent meeting users. The MAG-SM360 service module (for MAG6610 or MAG6611 chassis) will support up to 250 concurrent meeting users. The Secure Meeting licenses are additive up to the maximum limit supported on a given platform. For example, on a single MAG2600, the customer can start with a 25-user license and then add another 25 users to support up to 50 concurrent meeting users (maximum limit) on that platform. Regarding clustering with Secure Meeting, the maximum user count across any platform cluster cannot exceed twice the total meeting count supported on that platform. For example, on the MAG-SM360 service module (for either MAG6610 or MAG6611 chassis) when clustered, there will be support for a maximum of 500 meeting users in the cluster. A common point of confusion is the difference between a Secure Meeting user and a standard logged-in user. Which users count against which limit? For those users who are logged into the MAG Series gateway (using their username/password) and also in a meeting, those users will count against both the concurrent user license limit and against the Secure Meeting license limit. Those users who join only a Secure Meeting using the meeting password, but do not fully log into the MAG Series gateway, will count against the Secure Meeting license limit only. For more information, see the Secure Meeting Datasheet at In Case of Emergency (ICE) The ICE license enables temporary bursting capabilities for emergency situations in which a large number of employees must log in for a short period of time, such as in the event of a snowstorm or a virus outbreak like the H1N1 virus (swine flu). For the MAG Series, the ICE licenses come in two forms: 1) Full ICE (following the same design as prior releases such as the Juniper Networks SA Series SSL VPN Appliances ICE license option) 2) A new 25% burst license (allows bursting of up to 25% of the installed license count on any given MAG Series gateway) With the full ICE option, for example, a customer with a MAG4610 licensed for 100 concurrent users can add the MAGX600-ICE license. When applied and enabled, that ICE license will give the customer 1,000 concurrent users on that device. With the 25% burst license option, for example, if the customer has a MAG-SM360 module (regardless of whether it is in a MAG6610 or MAG6611 chassis), with a 1,000 user license, the 25% burst license option will provide support for an additional 250 users during an unplanned event. When ICE is applied but not enabled, the features cannot be used on that device unless the corresponding permanent feature license has been enabled on that device. ICE licenses can be applied and used on machines regardless of whether a concurrent user license has been added to that machine. For more information, see the ICE Datasheet at IF-MAP License Leveraging the Trusted Network Connect (TNC) Interface to Metadata Access Point (IF-MAP) specification, a MAG Series with the Juniper Networks Junos Pulse Access Control Service (as a standalone or in a cluster) can operate solely as a MAP server with no additional concurrent user licenses. In this mode, the MAG Series with the Junos Pulse Access Control Service (as a standalone or in a cluster as MAP servers) must have a MAP server license installed. Mixed MAG Series and MAP server mode is defined as any MAG Series gateway with the Junos Pulse Access Control Service that simultaneously acts as both a MAG Series gateway with the Junos Pulse Access Control Service and as a MAP server, where a concurrent user license has been installed. In this case, the MAP Server license is not required on that MAG Series gateway (or gateway cluster). RADIUS License License enables organizations that wish to deploy a RADIUS appliance access to only the authentication, authorization, and accounting (AAA)/RADIUS features of the Junos Pulse Access Control Service-enabled MAG Series gateways, while introducing the organization to the MAG Series gateways and the Junos Pulse Access Control Service, as well as allowing the organization to upgrade to a full featured Junos Pulse Access Control Service license at a future date. Enterprise Licensing Enterprise licensing allows any organization with one or more devices to easily lease user licenses from one appliance to another, as required, to adapt to changing organizational needs. Any of the MAG Series models can be used as a license server. You can do this by applying the appropriate LICENSE-MBR license (depending on the MAG Series model) to a MAG2600, MAG4610, or a service module (MAG-SM160 or MAG-SM360) on the MAG6610 or MAG6611. Ideally, making the MAG2600 as the license 2

3 server would be the most cost-effective option. Once this license is applied, the MAG Series gateway will cease to accept client VPN connections and it will be a dedicated license server. Then you will need to add the appropriate membership license to other gateways so that it can communicate with the license server. For example, MAG4610-LICENSE-MBR installed on each of two MAG4610 gateways would allow their licenses to be leasable back and forth. Please refer to the Enterprise Licensing FAQ for more information. Lab Licenses Lab licenses are designed to allow customers to deploy the MAG Series in a test, lab, or pilot environment before deciding to roll it out to their production environment. Lab licenses are valid for 52 weeks and will support all features up to 10 concurrent users. Please note that third-party components such as the Enhanced Endpoint Security license are not included as part of the lab license. Customers will typically get a 2-user account of third-party components such as the Enhanced Endpoint Security license for free as part of the MAG Series hardware. After 52 weeks, customers will need to renew their lab license (free, provided they are covered by a support contract). Note that these SKUs do not include the base hardware system. Evaluation Licenses Evaluation licenses are designed for pre-sale evaluations. Juniper s sales reps and partners can provide these licenses to prospective customers for a limited time so that they can evaluate the platform before they make a purchasing decision. Note that these SKUs do not include the base hardware system. Optional Subscription Feature Licenses Enhanced Endpoint Security The Enhanced Endpoint Security license provides a full featured, dynamically deployable antispyware/ antimalware module that is an OEM of Webroot s industry-leading Spy Sweeper product. With this new capability, organizations can ensure that unmanaged and managed Microsoft Windows endpoint devices conform to corporate security policies before they are allowed to access the network, applications, and resources. For example, potentially harmful keyloggers can be found and removed from an endpoint device before users enter sensitive information such as their user credentials. The Enhanced Endpoint Security license protects endpoints from infection in real time and ensures that only clean endpoints are granted network access. Please note that customers who may have been running the free 25 user count of Advanced Endpoint Defense (AED) license will only get two users for free with the Enhanced Endpoint Security license. This free amount is meant for testing purposes only and not intended for use in production. The Enhanced Endpoint Security licenses for the MAG Series are available in 1-year, 2-year, and 3-year subscription options and can be used with any MAG Series model. For more information, see the Enhanced Endpoint Security Datasheet at pdf/datasheets/ en.pdf. Premier Java RDP Applet The Premier Java RDP Applet license provides companies with a platform independent, Java-based solution for accessing Microsoft Windows Terminal Servers. It makes business critical data in Windows-based applications available to all remote users, regardless of the type of hardware or OS they are using. With the Premier Java RDP Applet option, central installation and administration are available through Java technology. When used in combination with the Premier RDP Applet option, the Java Windows Terminal provides one of the most convenient terminal server access experiences. The Premier Java RDP Applet licenses for the MAG Series are available in 1-year, 2-year, and 3-year subscription options. For more information, see the Premier Java RDP Applet Datasheet at Patch Remediation The patch remediation license automatically remediates noncompliant endpoints by updating software applications that do not comply to corporate security policies. It does not require Microsoft s Short Message Service (SMS) protocol for remediation and covers patches for Microsoft and other vendors such as Adobe, Firefox, Apache, Real Player, and others. It directly downloads missing patches from vendors websites without going through the MAG Series appliances. Patch remediation is available for the MAG Series in 1-year, 2-year, and 3-year subscription options. Accessories and Upgrades for the Hardware Models Rack Mount Kits There are rack mount kits that can be ordered for the MAG Series models. The MAG4610, MAG6610, and MAG6611 gateways already ship with rack mount kits, but spare ones are available for order. Power Cords These are available in several country versions, per the pricelist (USA, UK, EU, AU, CH, CN, IT, KR). The MAG Series gateways will ship with the appropriate power cord based on the ship-to address. Hard Drives There are field replaceable spare hard drives for the MAG-SM360 service modules. These drives can be used to replace failed drives and are hot-swappable. The MAG-SM160 ships with one hard drive (RAID not supported), and the MAG-SM360 ships with two hard drives (RAID 1 supported). Power Supplies There are spare AC power supplies available for the MAG2600, MAG6610, and MAG6611. An additional AC power supply can be installed on the MAG6611 for redundancy or used as a spare. There is also a DC power supply option available for the MAG6610 and MAG6611 3

4 Services There are many service offerings, but we will only focus on the most common option which is next day RMA replacement. Please keep in mind that there are other options, including Core (COR), Core Plus (CP), Next Day Onsite (NDCE), Same Day Onsite (SDCE), and Same Day (ND). In Section II, each platform will have the appropriate next day RMA replacement SKUs that can be purchased. Deprecated SSL VPN Features There are certain outdated SSL VPN features previously found in the SA Series platform that will no longer be supported on the new MAG Series platform. Here is the list of deprecated SSL VPN features not found in the MAG Series: 1) Instant Virtual System (IVS) Customers looking for a virtualized SSL VPN solution are instead encouraged to move to the SSL VPN virtual appliances platform. 2) WAN Clustering Multisite clustering support is limited to campus networks, where the connectivity is on par with a LAN experience. 3) Gzip Compression This obsolete compression feature is no longer available on the MAG Series. 4) Proxy This does not apply to ActiveSync, but rather to the legacy SMTP offering. Customers using this option will need to continue to use the SA Series hardware to support this feature. 5) Multicast/Broadcast for Cluster Communications This is not needed with the cluster protocol as it exists today. 4

5 Section II: Availability by Platform MAG2600 Junos Pulse Gateway The MAG2600 Junos Pulse Gateway is designed to enable SSL VPN or guest access capabilities for small and medium enterprises. SALES TIP: All MAG Series models include Junos Pulse, a dynamic, integrated, multiservice network client for mobile and non-mobile devices. For more The MAG2600 offers the following: details on Junos Pulse, please visit net/us/en/products-services/software/junosplatform/junos-pulse. Fixed configuration hardware appliance Can be used for SSL VPN or enterprise guest access capabilities Supports up to 100 SSL VPN users or 200 guest users Small form-factor design (1 U high) Rack-mountable or can be placed on a desk SSL VPN mode includes Junos Pulse Secure Access Service (SA 7.1 or higher software features) Guest access mode includes all enterprise guest access features (must order Enterprise Guest Access licensemagx600-guest- ACCESS) Equivalent to Juniper Networks SA700 SSL VPN Appliance and SA2500 SSL VPN Appliance With the EOL of the SA700 appliance in March 2011, the MAG2600 is the ideal SA700 replacement and offers advantages such as ActiveSync proxy for mobile access, lower power consumption, lower noise level, smaller footprint, and four times the scalability over SA700. Please note that the common access license options for the MAG2600 can only be used for SSL VPN mode. Enterprise guest access capability will require the specific enterprise guest access license (MAGX600-GUEST-ACCESS) to be enabled on the MAG2600. Each MAG2600 will ship with a power supply and power cord for the appropriate region (based on the ship-to address). A spare rack mount kit is available to place four MAG2600 units side-by-side in a rack. License Availability: MAG2600 GATEWAY Common Access License Guest Access Secure Meeting ICE IF-MAP RADIUS Enterprise Licensing Enhanced Endpoint Security Premier Java RDP Applet Patch Remediation Lab Eval Up to 100 user license for SSL VPN mode only 200 guest user license (MAGX600-GUEST-ACCESS) for guest access mode only (up to 50 meeting users) (full ICE option or 25% burst option) Platform SKUs SKU MAG2600 Description MAG2600 Base System MAG2600 Common Access Licenses ACCESSX600-ADD-10U ACCESSX600-ADD-25U ACCESSX600-ADD-50U ACCESSX600-ADD-100U MAGX600-GUEST-ACCESS Add 10 simultaneous users to MAG2600 (for SSL VPN only) Add 25 simultaneous users to MAG2600 (for SSL VPN only) Add 50 simultaneous users to MAG2600 (for SSL VPN only) Add 100 simultaneous users to MAG2600 (for SSL VPN only) Guest Access License for MAG2600 (for Enterprise Guest Access only) 5

6 SKU Description MAG2600 Feature Licenses ACCESSX600-MTG-25U ACCESSX600-MTG-50U ACCESS-ICE-25PC MAGX600-ICE MAGX600-IFMAP MAGX600-RADIUS-SERVER MAG2600-LICENSE-MBR Add 25 simultaneous Secure Meeting users to X600 Series Appliances Add 50 simultaneous Secure Meeting users to X600 Series Appliances In Case of Emergency (ICE) 25% Burst to 25% of installed license count on X500 or X600 Series Appliances In Case of Emergency (ICE) license for X600 Series Appliances License for IF-MAP server on standalone X600 Series Appliances Add RADIUS server feature to X600 Series Appliances Allows MAG2600 appliance to participate in leased licensing Optional Subscription Feature Licenses (asterisks noted on these since there are various user and yearly subscription options) ACCESS-PRM-*U-*YR ACCESS-RDP-*U-*YR ACCESS-EES-*U-*YR Patch remediation management for * users for * years RDP Java Applet for * users for * years Enhanced Endpoint Security for * users for * years MAG2600 Accessories CBL-SPR-PWR-2PRONG-AU CBL-SPR-PWR-2PRONG-CH CBL-SPR-PWR-2PRONG-CN CBL-SPR-PWR-2PRONG-EU CBL-SPR-PWR-2PRONG-IT CBL-SPR-PWR-2PRONG-KR CBL-SPR-PWR-2PRONG-UK CBL-SPR-PWR-2PRONG-US MAG-PS260 BOX-MAG26XX MAG-RK1U4 MAG-PS260 Power Cable, Spare, Australia MAG-PS260 Power Cable, Spare, Switzerland MAG-PS260 Power Cable, Spare, China MAG-PS260 Power Cable, Spare, EU MAG-PS260 Power Cable, Spare, Italy MAG-PS260 Power Cable, Spare, Korea MAG-PS260 Power Cable, Spare, UK MAG-PS260 Power Cable, Spare, US Spare/replacement external brick power supply for MAG2600 Shipping container (spare) for MAG2600 Rack kit to place four MAG2600 gateways side-by-side in a rack MAG2600 Next Day Replacement Service Options SVC-ND-MAG2600-S SVC-ND-MAG2600-L SVC-ND-MAG2600-M SVC-ND-MAG2600-H SVC-COR-MAG2600-GA MAG2600 support for 1-10 users (SKU also used when MAG2600 is acting as a license server) MAG2600 support for users MAG2600 support for users MAG2600 support for 100 users MAG2600 support for Guest Access 6

7 MAG4610 Junos Pulse Gateway The MAG4610 Junos Pulse Gateway is designed to enable SSL VPN or network access control capabilities for medium to large sized enterprises. SALES TIP: Always position MAG Series over the legacy SA Series and IC Series UAC platforms. The older platforms are quickly nearing the end of their The MAG4610 offers the following: usable life and do not match up to the flexibility and Fixed configuration hardware appliance future-proof levels of the MAG Series gateways. Can be used for SSL VPN or NAC capabilities Supports up to 1,000 SSL VPN users or 5,000 NAC users 1 U, one-half width (may be deployed side-by-side in 1 U rack space) for two node cluster SSL VPN mode includes Junos Pulse Secure Access Service (SA 7.1 or higher software features) NAC mode includes Junos Pulse Access Control Service (UAC 4.1 or higher software features) Equivalent to Juniper Networks SA4500 SSL VPN Appliance or IC4500 Unified Access Control Appliance It is important to note that the common access license can be transferred between SSL VPN mode and NAC mode or vice versa on the MAG4610. For example, customers can use a 5,000 user license for SSL VPN and then later reapply the same license when a customer wants to enable NAC mode. Each MAG4610 will ship with power cord for the appropriate region (based on the ship-to address) and will also ship with single rack configuration kit. License Availability: MAG4610 GATEWAY Common Access License Secure Meeting ICE IF-MAP RADIUS Enterprise Licensing Enhanced Endpoint Security Premier Java RDP Applet Patch Remediation Lab Eval Up to 1,000 user license for SSL VPN mode or up to 5,000 user license for NAC mode for up to 100 meeting users (full ICE option or 25% burst option) 10 users Platform SKUs SKU Description MAG4610 Base System MAG4610 MAG4610 Base System MAG4610 Common Access Licenses ACCESSX600-ADD-10U ACCESSX600-ADD-25U ACCESSX600-ADD-50U ACCESSX600-ADD-100U ACCESSX600-ADD-250U ACCESSX600-ADD-500U ACCESSX600-ADD-1000U ACCESSX600-ADD-2000U ACCESSX600-ADD-2500U ACCESSX600-ADD-5000U Add 10 simultaneous users to MAG4610 Add 25 simultaneous users to MAG4610 Add 50 simultaneous users to MAG4610 Add 100 simultaneous users to MAG4610 Add 250 simultaneous users to MAG4610 Add 500 simultaneous users to MAG4610 Add 1,000 simultaneous users to MAG4610 (SSL VPN mode upper limit) Add 2,000 simultaneous users to MAG4610 (can be enabled for NAC mode) Add 2,500 simultaneous users to MAG4610 (can be enabled for NAC mode) Add 5,000 simultaneous users to MAG4610 (can be enabled for NAC mode) 7

8 SKU Description MAG4610 Feature Licenses ACCESSX600-MTG-25U ACCESSX600-MTG-50U ACCESSX600-MTG-100U ACCESS-ICE-25PC MAGX600-ICE MAGX600-IFMAP MAGX600-RADIUS-SERVER MAG4610-LICENSE-MBR Add 25 simultaneous Secure Meeting users to X600 Series Appliances Add 50 simultaneous Secure Meeting users to X600 Series Appliances Add 100 simultaneous Secure Meeting users to X600 Series Appliances In Case of Emergency (ICE) 25% Burst to 25% of installed license count on X500 or X600 Series Appliances In Case of Emergency (ICE) license for X600 Series Appliances License for IF-MAP server on standalone X600 Series Appliances Add RADIUS server feature to X600 Series Appliances Allows MAG4610 appliance to participate in leased licensing Subscription Licenses (asterisks noted on these since there are various user and yearly subscription options see pricelist for specific SKUs) ACCESS-PRM-*U-*YR ACCESS-RDP-*U-*YR ACCESS-EES-*U-*YR Patch Remediation Management for * users for * years RDP Java Applet for * users for * years Enhanced Endpoint Security for * users for * years MAG4610 Accessories CBL-SPR-PWR-2PRONG-AU CBL-SPR-PWR-2PRONG-CH CBL-SPR-PWR-2PRONG-CN CBL-SPR-PWR-2PRONG-EU CBL-SPR-PWR-2PRONG-IT CBL-SPR-PWR-2PRONG-KR CBL-SPR-PWR-2PRONG-UK CBL-SPR-PWR-2PRONG-US MAG-RK1U2 BOX-MAG46XX MAG-PS260 Power Cable, Spare, Australia MAG-PS260 Power Cable, Spare, Switzerland MAG-PS260 Power Cable, Spare, China MAG-PS260 Power Cable, Spare, EU MAG-PS260 Power Cable, Spare, Italy MAG-PS260 Power Cable, Spare, Korea MAG-PS260 Power Cable, Spare, UK MAG-PS260 Power Cable, Spare, US Rack kit to mount 2 MAG4610 units side-by-side in a rack or when included rack kit is lost or damaged. The 1X rack kit that ships with unit is not orderable. Shipping container (spare) for MAG4610 MAG4610 Next Day Replacement Service Options SVC-ND-MAG4610-L SVC-ND-MAG4610-M SVC-ND-MAG4610-H MAG4610 support for users MAG4610 support for users MAG4610 support for 250+ users 8

9 MAG6610 Junos Pulse Gateway The MAG6610 gateway is designed to enable SSL VPN and NAC capabilities for SALES TIP: When stacking licenses, e.g., adding a scalable, large enterprise customers. 1,000 user license and a 500 user license to give the MAG6610 offers the following: customer 1,500 concurrent users, always look at the 1 U high chassis modular configuration next highest single license option, because it will Supports up to two service modules (any combination of MAG-SM160 or often be less expensive while providing additional MAG-SM360) for SSL VPN and/or NAC capabilities user counts for future growth. In the example given, Can enable SSL VPN mode on one module and NAC mode on another the single 2,500 concurrent user license is actually module significantly less expensive than the 1, Maximum support of up to 20,000 SSL VPN or 30,000 NAC users concurrent user option. Optional management module available (MAG-CM060) SSL VPN mode includes Junos Pulse Secure Access Service (SA 7.1 or higher software features) NAC mode includes Junos Pulse Access Control Service (UAC 4.1 or higher software features) Equivalent to SA4500/SA6500 or IC4500/IC6500 The MAG-SM160 service module supports up to 1,000 SSL VPN users and up to 5,000 NAC users. The MAG-SM360 service module supports up to 10,000 SSL VPN users and up to 15,000 NAC users. For maximum users on MAG6610, two MAG-SM360 modules will support up to 20,000 SSL VPN or 30,000 NAC users. Below are photos of the MAG-SM160 and MAG-SM360 respectively. The MAG-CM060 management module plugs in front of a dedicated reserved slot in the service module. Up to two MAG-CM060 management modules can be installed in two service modules, but only one can be active. Below is the photo of the MAG-CM060 management module. It is important to note that the common access license can be transferred between SSL VPN mode and NAC mode or vice versa on the MAG6610. For example, a customer can use a 5,000 user license for SSL VPN on the MAG-SM360 module and then later reapply the same license when the customer wants to enable NAC mode on the MAG- SM360 module. For the MAG6610, a common access license is required for each service module enabled in the chassis. Here is what is included with the MAG6610 chassis and its service modules: The MAG6610 chassis includes a power supply (MAG-PS661), an appropriate power cord (based on the ship-to address), and a rack mount kit (MAG-RK1U). The MAG-SM160 includes the primary service module for SSL VPN or NAC use, a hard disk (MAG-HD060 only one supported, no RAID), and 2 fan trays (MAG-FT060). The MAG-SM360 includes the primary service module for SSL VPN or NAC use, 2 hard disks (MAG-HD060 RAID 1 Mirror), and 2 fan trays (MAG-FT060). 9

10 License Availability: MAG6610 GATEWAY Common Access License Secure Meeting Up to 1,000 user license for SSL VPN mode or up to 5,000 user license for NAC mode on MAG-SM160 Up to 10,000 user license for SSL VPN mode or up to 15,000 user license for NAC mode on MAG-SM360 Up to 100 meeting users on MAG-SM160 Up to 250 meeting users on MAG-SM360 ICE IF-MAP RADIUS Enterprise Licensing Enhanced Endpoint Security Premier Java RDP Applet Patch Remediation Lab Eval (full ICE option or 25% burst option) 10 users Platform SKUs SKU Description MAG6610 Base System MAG6610 MAG6610 Base System MAG6610 Modules MAG-SM160 MAG-SM360 MAG-CM060 Service module for MAG6610 or MAG6611 that supports 1,000 SSL VPN or 5,000 NAC users. Service module for MAG6610 or MAG6611 that supports 10,000 SSL VPN or 15,000 NAC users. Management module for MAG6610 or MAG6611 (only orderable with at least one service module, and a maximum of two management modules can be ordered per chassis) MAG6610 Common Access Licenses ACCESSX600-ADD-10U ACCESSX600-ADD-25U ACCESSX600-ADD-50U ACCESSX600-ADD-100U ACCESSX600-ADD-250U ACCESSX600-ADD-500U ACCESSX600-ADD-1000U ACCESSX600-ADD-2000U ACCESSX600-ADD-2500U ACCESSX600-ADD-5000U ACCESSX600-ADD-7500U ACCESSX600-ADD-10KU ACCESSX600-ADD-15KU Add 10 simultaneous users to MAG6610 Add 25 simultaneous users to MAG6610 Add 50 simultaneous users to MAG6610 Add 100 simultaneous users to MAG6610 Add 250 simultaneous users to MAG6610 Add 500 simultaneous users to MAG6610 Add 1,000 simultaneous users to MAG6610 (upper SSL VPN mode limit with MAG-SM160) Add 2,000 simultaneous users to MAG6610 Add 2,500 simultaneous users to MAG6610 Add 5,000 simultaneous users to MAG6610 (upper NAC mode limit with MAG-SM160) Add 7,500 simultaneous users to MAG6610 Add 10,000 simultaneous users to MAG6610 (upper SSL VPN mode limit with MAG-SM360) Add 15,000 simultaneous users to MAG6610 (upper NAC mode limit with MAG-SM360) 10

11 SKU Description MAG6610 Feature Licenses ACCESSX600-MTG-25U ACCESSX600-MTG-50U ACCESSX600-MTG-100U ACCESSX600-MTG-250U ACCESS-ICE-25PC MAGX600-ICE MAGX600-IFMAP MAGX600-RADIUS-SERVER SM160-LICENSE-MBR SM360-LICENSE-MBR Add 25 simultaneous Secure Meeting users to X600 Series Appliances Add 50 simultaneous Secure Meeting users to X600 Series Appliances Add 100 simultaneous Secure Meeting users to X600 Series Appliances Add 250 simultaneous Secure Meeting users to X600 Series Appliances In Case of Emergency (ICE) 25% Burst to 25% of installed license count on X500 or X600 Series Appliances In Case of Emergency (ICE) License for X600 Series Appliances License for IF-MAP server on standalone X600 Series Appliances Add RADIUS Server Feature to X600 Series Appliances Allows leased licensing for MAG-SM160 module Allows leased licensing for MAG-SM360 module Subscription Licenses (asterisks noted on these since there are various user and yearly subscription options see pricelist for specific SKUs) ACCESS-PRM-*U-*YR ACCESS-RDP-*U-*YR ACCESS-EES-*U-*YR Patch Remediation Management for * users for * years RDP Java Applet for * users for * years Enhanced Endpoint Security for * users for * years MAG6610 Accessories CBL-SPR-PWR-2PRONG-AU CBL-SPR-PWR-2PRONG-CH CBL-SPR-PWR-2PRONG-CN CBL-SPR-PWR-2PRONG-EU CBL-SPR-PWR-2PRONG-IT CBL-SPR-PWR-2PRONG-KR CBL-SPR-PWR-2PRONG-UK CBL-SPR-PWR-2PRONG-US MAG-PS661 MAG-PS664 MAG-RK1U MAG-HD060 MAG-FT060 BOX-MAG6610 BOX-MAGSM MAG-PS260 Power Cable, Spare, Australia MAG-PS260 Power Cable, Spare, Switzerland MAG-PS260 Power Cable, Spare, China MAG-PS260 Power Cable, Spare, EU MAG-PS260 Power Cable, Spare, Italy MAG-PS260 Power Cable, Spare, Korea MAG-PS260 Power Cable, Spare, UK MAG-PS260 Power Cable, Spare, US Spare 560 W AC power supply module for MAG6610 Spare 560 W DC power supply module for MAG6610 Replacement rack kit for MAG6610 Spare hard drive (in tray) for MAG-SM360 module Spare fan tray for MAG6610 or MAG6611 Shipping container (spare) for MAG6610 Shipping container (spare) for MAG-SM160 or MAG-SM360 module MAG6610 Next Day Replacement Service Options SVC-ND-MAG6610 SVC-ND-MAG-SM160-L SVC-ND-MAG-SM160-M SVC-ND-MAG-SM160-H SVC-ND-MAG-SM360-L SVC-ND-MAG-SM360-M SVC-ND-MAG-SM360-H Next day support for MAG6610 chassis MAG-SM160 support for users MAG-SM160 support for users MAG-SM160 support for 250+ users MAG-SM360 support for users MAG-SM360 support for 501-5,000 users MAG-SM360 support for 5,000+ users 11

12 MAG6611 Junos Pulse Gateway The MAG6611 gateway is designed to enable SSL VPN and network access SALES TIP: Whenever possible, position the control capabilities that meet the most demanding access needs of large MAG6611 chassis over the MAG6610 chassis. This enterprise customers. provides more power options, as well as future MAG6611 offers the following: upgrade potential for only a small amount more. 2 U high chassis modular configuration Supports up to four service modules (any combination of MAG-SM160 or MAG-SM360) for SSL VPN and/or NAC capabilities Can enable SSL VPN mode on one or more modules, and NAC mode on one or more modules Maximum support of up to 40,000 SSL VPN or 60,000 NAC users Optional management module available (MAG-CM060) Additional power supply available (MAG-PS662) for redundancy SSL VPN mode includes Junos Pulse Secure Access Service (SA 7.1 or higher software features) NAC mode includes Junos Pulse Access Control Service (UAC 4.1 or higher software features) Equivalent to SA4500/SA6500 or IC4500/IC6500 The MAG-SM160 service module supports up to 1,000 SSL VPN users and up to 5,000 NAC users. The MAG-SM360 service module supports up to 10,000 SSL VPN users and up to 15,000 NAC users. For maximum user support on the MAG6611, four MAG-SM360 modules will support up to 40,000 SSL VPN or 60,000 NAC users. The MAG-CM060 management module plugs in front of a dedicated reserved slot in the service module. Up to two MAG-CM060 management modules can be installed in two service modules, but only one can be active. It is important to note that the common access license can be transferred between SSL VPN mode and NAC mode or vice versa on the MAG6611. For example, customers can use a 5,000 user license for SSL VPN on the MAG-SM360 module and then later reapply the same license when the customer wants to enable NAC mode on the MAG-SM360 module. For the MAG6611, a common access license is required for each service module enabled in the chassis. Here is what is included with the MAG6611 chassis and its service modules: The MAG6611 chassis includes one power supply (MAG-PS662 redundant option available with the purchase of another MAG-PS662), an appropriate power cord (based on the ship-to address), and a rack mount kit (MAG-RK2U). The photo below shows what the MAG6611 will look like when it s pulled out of the shipping box; this is what it would look like without any of the service modules installed. 12

13 The MAG-SM160 includes the primary service module for SSL VPN or NAC use, a hard disk (MAG-HD060 only one supported, no RAID), and 2 fan trays (MAG-FT060). Below is the photo of the MAG-SM160 items that are included in the shipping box. The MAG-SM360 includes the primary service module for SSL VPN or NAC use, 2 hard disks (MAG-HD060 RAID 1 Mirror), and 2 fan trays (MAG-FT060). Below is the photo of the MAG-SM360 items that are included in the shipping box. License Availability: MAG6611 GATEWAY Common Access License Secure Meeting Up to 1,000 user license for SSL VPN mode or up to 5,000 user license for NAC mode on MAG-SM160 Up to 10,000 user license for SSL VPN mode or up to 15,000 user license for NAC mode on MAG-SM360 Up to 100 meeting users on MAG-SM160 Up to 250 meeting users on MAG-SM360 ICE IF-MAP RADIUS Enterprise Licensing Enhanced Endpoint Security Premier Java RDP Applet Patch Remediation Lab Eval (full ICE option or 25% burst option) 10 users 13

14 Platform SKUs SKU Description MAG6611 Base System MAG6611 MAG6611 Base System MAG6611 Modules MAG-SM160 MAG-SM360 MAG-CM060 Service module for MAG6610 or MAG6611 that supports 1,000 SSL VPN or 5,000 NAC users. Service module for MAG6610 or MAG6611 that supports 10,000 SSL VPN or 15,000 NAC users. Management module for MAG6610 or MAG6611 (only orderable with at least one service module, and a maximum of two management modules can be ordered per chassis) MAG6611 Common Access Licenses ACCESSX600-ADD-10U ACCESSX600-ADD-25U ACCESSX600-ADD-50U ACCESSX600-ADD-100U ACCESSX600-ADD-250U ACCESSX600-ADD-500U ACCESSX600-ADD-1000U ACCESSX600-ADD-2000U ACCESSX600-ADD-2500U ACCESSX600-ADD-5000U ACCESSX600-ADD-7500U ACCESSX600-ADD-10KU ACCESSX600-ADD-15KU Add 10 simultaneous users to MAG6610 Add 25 simultaneous users to MAG6610 Add 50 simultaneous users to MAG6610 Add 100 simultaneous users to MAG6610 Add 250 simultaneous users to MAG6610 Add 500 simultaneous users to MAG6610 Add 1,000 simultaneous users to MAG6610 (upper SSL VPN mode limit with MAG-SM160) Add 2,000 simultaneous users to MAG6610 Add 2,500 simultaneous users to MAG6610 Add 5,000 simultaneous users to MAG6610 (upper NAC mode limit with MAG-SM160) Add 7,500 simultaneous users to MAG6610 Add 10,000 simultaneous users to MAG6610 (upper SSL VPN mode limit with MAG-SM360) Add 15,000 simultaneous users to MAG6610 (upper NAC mode limit with MAG-SM360) MAG6611 Feature Licenses ACCESSX600-MTG-25U ACCESSX600-MTG-50U ACCESSX600-MTG-100U ACCESSX600-MTG-250U ACCESS-ICE-25PC MAGX600-ICE MAGX600-IFMAP MAGX600-RADIUS-SERVER SM160-LICENSE-MBR SM360-LICENSE-MBR Add 25 simultaneous Secure Meeting users to X600 Series Appliances Add 50 simultaneous Secure Meeting users to X600 Series Appliances Add 100 simultaneous Secure Meeting users to X600 Series Appliances Add 250 simultaneous Secure Meeting users to X600 Series Appliances In Case of Emergency (ICE) 25% Burst to 25% of installed license count on X500 or X600 Series Appliances In Case of Emergency (ICE) License for X600 Series Appliances License for IF-MAP server on standalone X600 Series Appliances Add RADIUS Server Feature to X600 Series Appliances Allows leased licensing for MAG-SM160 module Allows leased licensing for MAG-SM360 module Subscription Licenses (asterisks noted on these since there are various user and yearly subscription options see pricelist for specific SKUs) ACCESS-PRM-*U-*YR ACCESS-RDP-*U-*YR ACCESS-EES-*U-*YR Patch remediation management for * users for * years RDP Java Applet for * users for * years Enhanced Endpoint Security for * users for * years 14

15 SKU Description MAG6610 Accessories CBL-SPR-PWR-2PRONG-AU CBL-SPR-PWR-2PRONG-CH CBL-SPR-PWR-2PRONG-CN CBL-SPR-PWR-2PRONG-EU CBL-SPR-PWR-2PRONG-IT CBL-SPR-PWR-2PRONG-KR CBL-SPR-PWR-2PRONG-UK CBL-SPR-PWR-2PRONG-US MAG-PS662 MAG-RK2U MAG-HD060 MAG-FT060 BOX-MAG6611 BOX-MAGSM MAG-PS260 Power Cable, Spare, Australia MAG-PS260 Power Cable, Spare, Switzerland MAG-PS260 Power Cable, Spare, China MAG-PS260 Power Cable, Spare, EU MAG-PS260 Power Cable, Spare, Italy MAG-PS260 Power Cable, Spare, Korea MAG-PS260 Power Cable, Spare, UK MAG-PS260 Power Cable, Spare, US Spare 750 W AC power supply module for MAG6611 Replacement rack kit for MAG6611 Spare hard drive (in tray) for MAG-SM360 module Spare fan tray for MAG6610 or MAG6611 Shipping container (spare) for MAG6611 Shipping container (spare) for MAG-SM160 or MAG-SM360 module MAG6611 Next Day Replacement Service Options SVC-ND-MAG6611 SVC-ND-MAG-SM160-L SVC-ND-MAG-SM160-M SVC-ND-MAG-SM160-H SVC-ND-MAG-SM360-L SVC-ND-MAG-SM360-M SVC-ND-MAG-SM360-H Next day support for MAG6611 chassis MAG-SM160 support for users MAG-SM160 support for users MAG-SM160 support for 250+ users MAG-SM360 support for users MAG-SM360 support for 501-5,000 users MAG-SM360 support for 5,000+ users 15

16 Section III: Example Configurations 1) MAG2600 for Guest Access with next day service contract: 1 x MAG x MAGX600-GUEST-ACCESS (supports 200 guest users) 1 x SVC-COR-MAG2600-GA 2) MAG2600 for 50 SSL VPN users, Secure Meeting support for 25 meeting users, and next day service contract: 1 x MAG x ACCESSX600-ADD-50U 1 x ACCESSX600-MTG-25U 1 x SVC-ND-MAG2600-L 3) MAG4610 for 500 SSL VPN users, Secure Meeting support for 50 meeting users, 25% burst license option, and next day service contract: 1 x MAG x ACCESSX600-ADD-500U 1 x ACCESSX600-MTG-50U 1 x ACCESS-ICE-25PC 1 x SVC-ND-MAG4610-H 4) MAG6610 for 1,000 SSL VPN users, 500 NAC users, Secure Meeting support for 100 meeting users, 25% burst license option, and next day service contract: 1 x MAG x MAG-SM160 (one for SSL VPN mode and one for NAC mode) 1 x ACCESSX600-ADD-1000U (enabled on first MAG-SM160 for SSL VPN users) 1 x ACCESSX600-ADD-500U (enabled on second MAG-SM160 for NAC users) 1 x ACCESSX600-MTG-100U 1 x ACCESS-ICE-25PC 1 x SVC-ND-MAG x SVC-ND-MAG-SM160-H 5) MAG6610 for 5,000 SSL VPN users, 1,000 NAC users, Secure Meeting support for 250 meeting users, full ICE option, RADIUS license, and next day service contract: 1 x MAG x MAG-SM360 (for SSL VPN mode) 1 x MAG-SM160 (for NAC mode) 1 x ACCESSX600-ADD-5000U (enabled on MAG-SM360 for SSL VPN users) 1 x ACCESSX600-ADD-1000U (enabled on MAG-SM160 for NAC users) 1 x ACCESSX600-MTG-250U 1 x MAGX600-ICE 1 x MAGX600-RADIUS-SERVER 1 x SVC-ND-MAG x SVC-ND-MAG-SM360-M 1 x SVC-ND-MAG-SM160-H 16

17 6) MAG6611 for 20,000 SSL VPN users, 10,000 NAC users, Secure Meeting support for 250 meeting users, full ICE option, IF-MAP license, and next day service contract: 1 x MAG x MAG-SM360 (two for SSL VPN mode, one for NAC mode) 3 x ACCESSX600-ADD-10KU (one license enabled on first MAG-SM360 for SSL VPN users, second license enabled on second MAG- SM360 for SSL VPN users, and third license enabled on third MAG-SM360 for NAC users) 1 x ACCESSX600-MTG-250U 1 x MAGX600-ICE 1 x MAGX600-IFMAP 1 x SVC-ND-MAG x SVC-ND-MAG-SM360-H Corporate and Sales Headquarters APAC Headquarters EMEA Headquarters To purchase Juniper Networks solutions, Juniper Networks, Inc North Mathilda Avenue Sunnyvale, CA USA Phone: 888.JUNIPER ( ) or Fax: Juniper Networks (Hong Kong) 26/F, Cityplaza One 1111 King s Road Taikoo Shing, Hong Kong Phone: Fax: Juniper Networks Ireland Airside Business Park Swords, County Dublin, Ireland Phone: EMEA Sales: Fax: please contact your Juniper Networks representative at or authorized reseller. Copyright 2011 Juniper Networks, Inc. All rights reserved. Juniper Networks, the Juniper Networks logo, Junos, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. All other trademarks, service marks, registered marks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice EN June 2011 Printed on recycled paper 17